DE · EN

Call us

build 6ddc7a35 | content blog-content@417154f · 338 posts | profiles 32 · corpus 315 | ● 0 skipped | built 2026-10-21 12:35 UTC format run

$ soultec get solution/endpoint-security/crowdstrike-falcon -o yaml$ soultec get solution/endpoint-security/crowdstrike-falcon -o json$ soultec get solution/endpoint-security/crowdstrike-falcon -o toml$ soultec get solution/endpoint-security/crowdstrike-falcon -o xml$ python3 endpoint-security/crowdstrike-falcon.pyPS> ./endpoint-security/crowdstrike-falcon.ps1$ go run endpoint-security/crowdstrike-falcon.go$ node endpoint-security/crowdstrike-falcon.js

apiVersion: soultec.ch/v1kind: Solutionmetadata: name: endpoint-security/crowdstrike-falcon locale: en labels: capability/endpoint-security: 2.73 capability/security: 1.91 vendor/crowdstrike: 4.38 annotations: source: src/content/solutions/en/endpoint-security/crowdstrike-falcon.md route: /en/solutions/endpoint-security/crowdstrike-falcon/ schema: /nerd/schema/solutions.json markdown: /en/solutions/endpoint-security/crowdstrike-falcon.mdspec: title: CrowdStrike Falcon tags: [endpoint-security, security] vendors: [crowdstrike] summary: >- Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module. photoNeed: A security console on screen with real alerts in it, being triaged stub: false draft: false kind: product addon: false status: current practice: >- CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black. practiceReview: false sections: - heading:

What it is

body: | Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from the device; the analysis runs in the vendor's cloud. What gets judged is behaviour, such as whether a process is reading another process's memory. - heading:

What it is for

body: | Estates that choose their endpoint security independently of the rest of the stack. Falcon ties you to no platform licence and covers Windows, macOS and Linux with the same sensor. The second point is growth: EDR is one module of several. Identity protection, cloud workloads and threat intelligence come out of the same console when they are needed. - heading:

What to watch

body: | The modules are licensed individually, and the feature set depends on the package you bought. Where no team is assigned to the EDR, managed detection and response belongs in the plan from day one.status: corpus: 315 services: - {ref: services/modern-workplace, score: 0.81} - {ref: services/managed-security, score: 0.48} - {ref: services/security, score: 0.45} - {ref: services/academy, score: 0.33} neighbours: - {ref: solutions/endpoint-security, relation: parent} - {ref: solutions/igel/addon/90meter, score: 0.70} - {ref: solutions/endpoint-security/microsoft-defender-atp, score: 0.70} search: /en/search.json

{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security/crowdstrike-falcon", "locale": "en", "labels": { "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38 }, "annotations": { "source": "src/content/solutions/en/endpoint-security/crowdstrike-falcon.md", "route": "/en/solutions/endpoint-security/crowdstrike-falcon/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/crowdstrike-falcon.md" } }, "spec": { "title": "CrowdStrike Falcon", "tags": [ "endpoint-security", "security" ], "vendors": [ "crowdstrike" ], "summary": "Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "product", "addon": false, "status": "current", "practice": "CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black.\n", "practiceReview": false, "sections": [ { "heading": "

What it is

", "body": "Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from the\ndevice; the analysis runs in the vendor's cloud. What gets judged is behaviour, such as\nwhether a process is reading another process's memory." }, { "heading": "

What it is for

", "body": "Estates that choose their endpoint security independently of the rest of the stack. Falcon\nties you to no platform licence and covers Windows, macOS and Linux with the same sensor.\n\nThe second point is growth: EDR is one module of several. Identity protection, cloud\nworkloads and threat intelligence come out of the same console when they are needed." }, { "heading": "

What to watch

", "body": "The modules are licensed individually, and the feature set depends on the package you\nbought.\n\nWhere no team is assigned to the EDR, managed detection and response belongs in the plan\nfrom day one." } ] }, "status": { "corpus": 315, "services": [ { "ref": "services/modern-workplace", "score": "0.81" }, { "ref": "services/managed-security", "score": "0.48" }, { "ref": "services/security", "score": "0.45" }, { "ref": "services/academy", "score": "0.33" } ], "neighbours": [ { "ref": "solutions/endpoint-security", "relation": "parent" }, { "ref": "solutions/igel/addon/90meter", "score": "0.70" }, { "ref": "solutions/endpoint-security/microsoft-defender-atp", "score": "0.70" } ], "search": "/en/search.json" }}

apiVersion = "soultec.ch/v1"kind = "Solution"[metadata]name = "endpoint-security/crowdstrike-falcon"locale = "en"[metadata.labels]"capability/endpoint-security" = 2.73"capability/security" = 1.91"vendor/crowdstrike" = 4.38[metadata.annotations]source = "src/content/solutions/en/endpoint-security/crowdstrike-falcon.md"route = "/en/solutions/endpoint-security/crowdstrike-falcon/"schema = "/nerd/schema/solutions.json"markdown = "/en/solutions/endpoint-security/crowdstrike-falcon.md"[spec]title = "CrowdStrike Falcon"tags = ["endpoint-security", "security"]vendors = ["crowdstrike"]summary = "Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module."photoNeed = "A security console on screen with real alerts in it, being triaged"stub = falsedraft = falsekind = "product"addon = falsestatus = "current"practice = '''CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black.'''practiceReview = false[[spec.sections]]heading = "

What it is

"body = '''Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from thedevice; the analysis runs in the vendor's cloud. What gets judged is behaviour, such aswhether a process is reading another process's memory.'''[[spec.sections]]heading = "

What it is for

"body = '''Estates that choose their endpoint security independently of the rest of the stack. Falconties you to no platform licence and covers Windows, macOS and Linux with the same sensor.The second point is growth: EDR is one module of several. Identity protection, cloudworkloads and threat intelligence come out of the same console when they are needed.'''[[spec.sections]]heading = "

What to watch

"body = '''The modules are licensed individually, and the feature set depends on the package youbought.Where no team is assigned to the EDR, managed detection and response belongs in the planfrom day one.'''[status]corpus = 315search = "/en/search.json"[[status.services]]ref = "services/modern-workplace"score = "0.81"[[status.services]]ref = "services/managed-security"score = "0.48"[[status.services]]ref = "services/security"score = "0.45"[[status.services]]ref = "services/academy"score = "0.33"[[status.neighbours]]ref = "solutions/endpoint-security"relation = "parent"[[status.neighbours]]ref = "solutions/igel/addon/90meter"score = "0.70"[[status.neighbours]]ref = "solutions/endpoint-security/microsoft-defender-atp"score = "0.70"

<?xml version="1.0" encoding="UTF-8"?><manifest kind="Solution"> <apiVersion>soultec.ch/v1</apiVersion> <metadata> <name>endpoint-security/crowdstrike-falcon</name> <locale>en</locale> <labels> <entry key="capability/endpoint-security">2.73</entry> <entry key="capability/security">1.91</entry> <entry key="vendor/crowdstrike">4.38</entry> </labels> <annotations> <source>src/content/solutions/en/endpoint-security/crowdstrike-falcon.md</source> <route>/en/solutions/endpoint-security/crowdstrike-falcon/</route> <schema>/nerd/schema/solutions.json</schema> <markdown>/en/solutions/endpoint-security/crowdstrike-falcon.md</markdown> </annotations> </metadata> <spec> <title>CrowdStrike Falcon</title> <tags> <item>endpoint-security</item> <item>security</item> </tags> <vendors> <item>crowdstrike</item> </vendors> <summary>Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module.</summary> <photoNeed>A security console on screen with real alerts in it, being triaged</photoNeed> <stub>false</stub> <draft>false</draft> <kind>product</kind> <addon>false</addon> <status>current</status> <practice>CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black. </practice> <practiceReview>false</practiceReview> <sections> <section> <heading>

What it is

</heading> <body>Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from thedevice; the analysis runs in the vendor's cloud. What gets judged is behaviour, such aswhether a process is reading another process's memory. </body> </section> <section> <heading>

What it is for

</heading> <body>Estates that choose their endpoint security independently of the rest of the stack. Falconties you to no platform licence and covers Windows, macOS and Linux with the same sensor.The second point is growth: EDR is one module of several. Identity protection, cloudworkloads and threat intelligence come out of the same console when they are needed. </body> </section> <section> <heading>

What to watch

</heading> <body>The modules are licensed individually, and the feature set depends on the package youbought.Where no team is assigned to the EDR, managed detection and response belongs in the planfrom day one. </body> </section> </sections> </spec> <status> <corpus>315</corpus> <services> <item> <ref>services/modern-workplace</ref> <score>0.81</score> </item> <item> <ref>services/managed-security</ref> <score>0.48</score> </item> <item> <ref>services/security</ref> <score>0.45</score> </item> <item> <ref>services/academy</ref> <score>0.33</score> </item> </services> <neighbours> <item> <ref>solutions/endpoint-security</ref> <relation>parent</relation> </item> <item> <ref>solutions/igel/addon/90meter</ref> <score>0.70</score> </item> <item> <ref>solutions/endpoint-security/microsoft-defender-atp</ref> <score>0.70</score> </item> </neighbours> <search>/en/search.json</search> </status></manifest>

# Code generated by the soultec.ch build. DO NOT EDIT.import jsonPAGE = { "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security/crowdstrike-falcon", "locale": "en", "labels": { "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38, }, "annotations": { "source": "src/content/solutions/en/endpoint-security/crowdstrike-falcon.md", "route": "/en/solutions/endpoint-security/crowdstrike-falcon/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/crowdstrike-falcon.md", }, }, "spec": { "title": "CrowdStrike Falcon", "tags": ["endpoint-security", "security"], "vendors": ["crowdstrike"], "summary": "Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": False, "draft": False, "kind": "product", "addon": False, "status": "current", "practice": ( "CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black.\n" ), "practiceReview": False, "sections": [ { "heading": "

What it is

", "body": ( "Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from the\n" "device; the analysis runs in the vendor's cloud. What gets judged is behaviour, such as\n" "whether a process is reading another process's memory." ), }, { "heading": "

What it is for

", "body": ( "Estates that choose their endpoint security independently of the rest of the stack. Falcon\n" "ties you to no platform licence and covers Windows, macOS and Linux with the same sensor.\n" "\n" "The second point is growth: EDR is one module of several. Identity protection, cloud\n" "workloads and threat intelligence come out of the same console when they are needed." ), }, { "heading": "

What to watch

", "body": ( "The modules are licensed individually, and the feature set depends on the package you\n" "bought.\n" "\n" "Where no team is assigned to the EDR, managed detection and response belongs in the plan\n" "from day one." ), }, ], }, "status": { "corpus": 315, "services": [ { "ref": "services/modern-workplace", "score": "0.81", }, { "ref": "services/managed-security", "score": "0.48", }, { "ref": "services/security", "score": "0.45", }, { "ref": "services/academy", "score": "0.33", }, ], "neighbours": [ { "ref": "solutions/endpoint-security", "relation": "parent", }, { "ref": "solutions/igel/addon/90meter", "score": "0.70", }, { "ref": "solutions/endpoint-security/microsoft-defender-atp", "score": "0.70", }, ], "search": "/en/search.json", },}if __name__ == "__main__": print(json.dumps(PAGE, indent=2, ensure_ascii=False))

# Code generated by the soultec.ch build. DO NOT EDIT.$Page = [ordered]@{ apiVersion = 'soultec.ch/v1' kind = 'Solution' metadata = [ordered]@{ name = 'endpoint-security/crowdstrike-falcon' locale = 'en' labels = [ordered]@{ 'capability/endpoint-security' = 2.73 'capability/security' = 1.91 'vendor/crowdstrike' = 4.38 } annotations = [ordered]@{ source = 'src/content/solutions/en/endpoint-security/crowdstrike-falcon.md' route = '/en/solutions/endpoint-security/crowdstrike-falcon/' schema = '/nerd/schema/solutions.json' markdown = '/en/solutions/endpoint-security/crowdstrike-falcon.md' } } spec = [ordered]@{ title = 'CrowdStrike Falcon' tags = @('endpoint-security', 'security') vendors = @('crowdstrike') summary = 'Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module.' photoNeed = 'A security console on screen with real alerts in it, being triaged' stub = $false draft = $false kind = 'product' addon = $false status = 'current' practice = @'CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black.'@ practiceReview = $false sections = @( [ordered]@{ heading = '

What it is

' body = @'Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from thedevice; the analysis runs in the vendor's cloud. What gets judged is behaviour, such aswhether a process is reading another process's memory.'@ } [ordered]@{ heading = '

What it is for

' body = @'Estates that choose their endpoint security independently of the rest of the stack. Falconties you to no platform licence and covers Windows, macOS and Linux with the same sensor.The second point is growth: EDR is one module of several. Identity protection, cloudworkloads and threat intelligence come out of the same console when they are needed.'@ } [ordered]@{ heading = '

What to watch

' body = @'The modules are licensed individually, and the feature set depends on the package youbought.Where no team is assigned to the EDR, managed detection and response belongs in the planfrom day one.'@ } ) } status = [ordered]@{ corpus = 315 services = @( [ordered]@{ ref = 'services/modern-workplace' score = '0.81' } [ordered]@{ ref = 'services/managed-security' score = '0.48' } [ordered]@{ ref = 'services/security' score = '0.45' } [ordered]@{ ref = 'services/academy' score = '0.33' } ) neighbours = @( [ordered]@{ ref = 'solutions/endpoint-security' relation = 'parent' } [ordered]@{ ref = 'solutions/igel/addon/90meter' score = '0.70' } [ordered]@{ ref = 'solutions/endpoint-security/microsoft-defender-atp' score = '0.70' } ) search = '/en/search.json' }}$Page | ConvertTo-Json -Depth 32

// Code generated by the soultec.ch build. DO NOT EDIT.package mainimport ( "encoding/json" "os")var page = map[string]any{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": map[string]any{ "name": "endpoint-security/crowdstrike-falcon", "locale": "en", "labels": map[string]any{ "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38, }, "annotations": map[string]any{ "source": "src/content/solutions/en/endpoint-security/crowdstrike-falcon.md", "route": "/en/solutions/endpoint-security/crowdstrike-falcon/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/crowdstrike-falcon.md", }, }, "spec": map[string]any{ "title": "CrowdStrike Falcon", "tags": []any{"endpoint-security", "security"}, "vendors": []any{"crowdstrike"}, "summary": "Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "product", "addon": false, "status": "current", "practice": "CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black.\n", "practiceReview": false, "sections": []any{ map[string]any{ "heading": "

What it is

", "body": "Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from the\n" + "device; the analysis runs in the vendor's cloud. What gets judged is behaviour, such as\n" + "whether a process is reading another process's memory.", }, map[string]any{ "heading": "

What it is for

", "body": "Estates that choose their endpoint security independently of the rest of the stack. Falcon\n" + "ties you to no platform licence and covers Windows, macOS and Linux with the same sensor.\n" + "\n" + "The second point is growth: EDR is one module of several. Identity protection, cloud\n" + "workloads and threat intelligence come out of the same console when they are needed.", }, map[string]any{ "heading": "

What to watch

", "body": "The modules are licensed individually, and the feature set depends on the package you\n" + "bought.\n" + "\n" + "Where no team is assigned to the EDR, managed detection and response belongs in the plan\n" + "from day one.", }, }, }, "status": map[string]any{ "corpus": 315, "services": []any{ map[string]any{ "ref": "services/modern-workplace", "score": "0.81", }, map[string]any{ "ref": "services/managed-security", "score": "0.48", }, map[string]any{ "ref": "services/security", "score": "0.45", }, map[string]any{ "ref": "services/academy", "score": "0.33", }, }, "neighbours": []any{ map[string]any{ "ref": "solutions/endpoint-security", "relation": "parent", }, map[string]any{ "ref": "solutions/igel/addon/90meter", "score": "0.70", }, map[string]any{ "ref": "solutions/endpoint-security/microsoft-defender-atp", "score": "0.70", }, }, "search": "/en/search.json", },}func main() { enc := json.NewEncoder(os.Stdout) enc.SetEscapeHTML(false) enc.SetIndent("", " ") if err := enc.Encode(page); err != nil { os.Exit(1) }}

// Code generated by the soultec.ch build. DO NOT EDIT.const page = { apiVersion: "soultec.ch/v1", kind: "Solution", metadata: { name: "endpoint-security/crowdstrike-falcon", locale: "en", labels: { "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/crowdstrike": 4.38, }, annotations: { source: "src/content/solutions/en/endpoint-security/crowdstrike-falcon.md", route: "/en/solutions/endpoint-security/crowdstrike-falcon/", schema: "/nerd/schema/solutions.json", markdown: "/en/solutions/endpoint-security/crowdstrike-falcon.md", }, }, spec: { title: "CrowdStrike Falcon", tags: ["endpoint-security", "security"], vendors: ["crowdstrike"], summary: "Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module.", photoNeed: "A security console on screen with real alerts in it, being triaged", stub: false, draft: false, kind: "product", addon: false, status: "current", practice: "CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black.\n", practiceReview: false, sections: [ { heading: "

What it is

", body: "Falcon is CrowdStrike's endpoint platform. A lean sensor supplies the events from the\n" + "device; the analysis runs in the vendor's cloud. What gets judged is behaviour, such as\n" + "whether a process is reading another process's memory.", }, { heading: "

What it is for

", body: "Estates that choose their endpoint security independently of the rest of the stack. Falcon\n" + "ties you to no platform licence and covers Windows, macOS and Linux with the same sensor.\n" + "\n" + "The second point is growth: EDR is one module of several. Identity protection, cloud\n" + "workloads and threat intelligence come out of the same console when they are needed.", }, { heading: "

What to watch

", body: "The modules are licensed individually, and the feature set depends on the package you\n" + "bought.\n" + "\n" + "Where no team is assigned to the EDR, managed detection and response belongs in the plan\n" + "from day one.", }, ], }, status: { corpus: 315, services: [ { ref: "services/modern-workplace", score: "0.81", }, { ref: "services/managed-security", score: "0.48", }, { ref: "services/security", score: "0.45", }, { ref: "services/academy", score: "0.33", }, ], neighbours: [ { ref: "solutions/endpoint-security", relation: "parent", }, { ref: "solutions/igel/addon/90meter", score: "0.70", }, { ref: "solutions/endpoint-security/microsoft-defender-atp", score: "0.70", }, ], search: "/en/search.json", },};console.log(JSON.stringify(page, null, 2));

# 62 lines · YAML · validated at build# 88 lines · JSON · validated at build# 94 lines · TOML · validated at build# 107 lines · XML · validated at build# 107 lines · Python · read back at build, equals the JSON record# 105 lines · PowerShell · read back at build, equals the JSON record# 111 lines · Go · read back at build, equals the JSON record# 96 lines · JavaScript · read back at build, equals the JSON record · served at /en/solutions/endpoint-security/crowdstrike-falcon.md

Solution · CrowdStrike

CrowdStrike Falcon

Endpoint detection and response from CrowdStrike. A lean sensor on the device, analysis in the cloud, and a platform that grows by module.

Topics Endpoint Security 2.73 Security 1.91

Vendors CrowdStrike 4.38

04Services

02Capabilities

315Corpus

photograph wantedA security console on screen with real alerts in it, being triaged

What it is

Falcon is CrowdStrike’s endpoint platform. A lean sensor supplies the events from the device; the analysis runs in the vendor’s cloud. What gets judged is behaviour, such as whether a process is reading another process’s memory.

What it is for

Estates that choose their endpoint security independently of the rest of the stack. Falcon ties you to no platform licence and covers Windows, macOS and Linux with the same sensor.

The second point is growth: EDR is one module of several. Identity protection, cloud workloads and threat intelligence come out of the same console when they are needed.

What to watch

The modules are licensed individually, and the feature set depends on the package you bought.

Where no team is assigned to the EDR, managed detection and response belongs in the plan from day one.

What we do with it

CrowdStrike replaces Carbon Black as our EDR product. We no longer support Carbon Black.

Who works with it

Do you work with this? Take a look at our open roles.